some SSL recommendations - finally